search

pentestfail / TA-Salesforce_Reports

Provides method to consume Salesforce.com reports via REST API without SOQL/SOSL queries to be indexed, put in kvstore, or both.
MIT License
3 stars 0 forks source link

Error indexing reports #2

Closed Fairux closed 6 years ago

Fairux commented 6 years ago

Hi dev team,

I'm trying to index some reports, I've successfully configured my account / password / token.

However, when I query the selected index, I get 7 events all like this:

screen shot 2018-07-30 at 5 24 59 am

I do not see any error in my DEBUG internal logs, I can see the query is going thru, and I see the seven indexed events.

I was wondering if according to the app description it will download a local CSV file and then it will monitor, this part is not clear, could you please give me insights on this?.

screen shot 2018-07-30 at 5 26 08 am

All help will be appreciated.

F.

pentestfail commented 6 years ago

Hi Fairux,

There are a couple of scenarios I've observed this behavior which usually are caused by the authentication requirements of the Salesforce organization or permissions of the account being used. The account Splunk uses must be able to access the Salesforce UI (not configured for "API only access") as a normal user would as it leverages a UI only function to export the CSV report and overcome Salesforce's reporting API row limitation complexities.

Before going into more detailed steps, first try removing the "security token" from the account configuration in the TA and test to see if any errors are generated which are more descriptive or if the report indexes correctly. If not, investigate the items below and let me know what you find.

Things to troubleshoot:

  1. Confirm your Salesforce authentication is not being redirected to non-Salesforce authentication system (Active Directory, SAML, etc.) as this is not supported
  2. Confirm the account is not "API only"
  3. Confirm Splunk host running the input is egressing any Salesforce organizational/account IP whitelists (if configured)
  4. Confirm the account being used is able to log into the Salesforce UI directly and access the configured report else troubleshoot account and/or report permissions

For some additional info on the Salesforce side see this article: https://developer.salesforce.com/docs/atlas.en-us.api.meta/api/sforce_api_concepts_security.htm

Fairux commented 6 years ago

I'm closing this error as it was related to extra characters in the summer '18 in the Report ID, the script was trying to export the data SalesForce was forcing the "Export with Format" option (xmls)

After returning to the classic view and use the Report ID without the extra character, I was able to extract the reports.

Fairux.

Akash-Banerjee commented 5 years ago

@Fairux - I am running into the same problem. I do not have any extra chars in the report id and am using the classic generated ID. What other changes were done (he script was trying to export the data SalesForce was forcing the "Export with Format" option (xmls)) ? Appreciate your help on this,

Thanks Akash

Fairux commented 5 years ago

Hi Akash, could you please post a screenshot of the events along with the current configuration of the add-on?